ebpf: defer batch API probe for batch lookup

[arunsingh]

Fixes #2013.

BatchLookup() and BatchLookupAndDelete() previously called haveBatchAPI() before attempting the actual batch lookup syscall. The feature probe creates a temporary map, which can require CAP_BPF, so a process that only needs to read from an already-open map could fail before trying the operation that would otherwise succeed.

This defers the batch API feature probe until after a non-ENOENT lookup syscall failure, matching the existing BatchUpdate() and BatchDelete() behavior. The normal end-of-iteration ENOENT path remains unchanged.

The regression test creates maps while privileged, drops all effective capabilities, then verifies batch lookup, update, and delete through the existing map FDs.

Tested:

• go test -exec sudo -run '^(TestHaveBatchAPI|TestMapBatch|TestMapBatchUnprivileged|TestMapBatchCursorReuse)$' .
• git diff --check -- map.go map_test.go

[arunsingh]

Ready for review. I kept the change limited to BatchLookup/BatchLookupAndDelete via batchLookupCmd(), with ENOENT behavior unchanged. The focused regression and root package tests pass on a Linux VM; details are in the PR description.

[dylandreimerink]

Thank you! Change seems good to me, just want to change the regression test.

[dylandreimerink]

Changes look good to me.

CI failure turns out to be caused by a bug in WithCapabilities, on 5.4 we trigger the skip, which breaks the capabilities of other tests that run after TestMapBatchUnprivileged.

Fix is underway in #2023, so you will have to rebase to pull it in once merged.

[arunsingh]

Changes look good to me.

CI failure turns out to be caused by a bug in WithCapabilities, on 5.4 we trigger the skip, which breaks the capabilities of other tests that run after TestMapBatchUnprivileged.

Fix is underway in #2023, so you will have to rebase to pull it in once merged.

Thanks @dylandreimerink . As you pointed out that #2023 is merged now, so I rebased this branch on current main and pushed the updated commit. The focused batch regression still passes locally. I’ll keep an eye on CI from here.